From d5f04b42234fe369bfac686670837ff3fcb7afc6 Mon Sep 17 00:00:00 2001
From: Mikkel Krautz <mikkel@krautz.dk>
Date: Sat, 25 Feb 2017 23:10:38 +0100
Subject: [PATCH] Meta: avoid cluttering the global
 QSslSocket::defaultCaCertificates() list.

Before this commit, we would add any intermediate certificates found in
the SSL certificate's PEM bundle to the default CA list via
QSslSocket::addDefaultCaCertificates().
We would also add any certificates found in the sslCA PEM bundle to the
default CA list, using the same method.

Due to the way the hot-reload feature for SSL settings is going to work,
these patterns wouldn't work well in that environment, because reloading
the settings would keep adding entries to the global QSslSocket default
CA certificates list. (QSslSocket::defaultCaCertificates())

To combat this, this series of commits try to be more strict about how
default CAs and intermediates in general are handled.

Generally, instead of adding them to the global QSslSocket default CA
list, we add them to each QSslSocket as necessary.

Note: this commit does not stand on its own. It requires the follow-up
commits in this PR. It is split out to aid in reviewing.
---
 src/murmur/Meta.cpp |  6 +++---
 src/murmur/Meta.h   | 16 ++++++++++++++++
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/src/murmur/Meta.cpp b/src/murmur/Meta.cpp
index e9bdd4322..b68fc6714 100644
--- a/src/murmur/Meta.cpp
+++ b/src/murmur/Meta.cpp
@@ -374,7 +374,7 @@ void MetaParams::read(QString fname) {
 			if (ql.isEmpty()) {
 				qCritical("Failed to parse any CA certificates from %s", qPrintable(qsSSLCA));
 			} else {
-				QSslSocket::addDefaultCaCertificates(ql);
+				qlCA = ql;
 			}
 		} else {
 			qCritical("Failed to read %s", qPrintable(qsSSLCA));
@@ -428,8 +428,8 @@ void MetaParams::read(QString fname) {
 			qFatal("Failed to find certificate matching private key.");
 		}
 		if (ql.size() > 0) {
-			QSslSocket::addDefaultCaCertificates(ql);
-			qCritical("Adding %d CA certificates from certificate file.", ql.size());
+			qlIntermediates = ql;
+			qCritical("Adding %d intermediate certificates from certificate file.", ql.size());
 		}
 	}
 
diff --git a/src/murmur/Meta.h b/src/murmur/Meta.h
index c887a2be8..7cbfaedda 100644
--- a/src/murmur/Meta.h
+++ b/src/murmur/Meta.h
@@ -93,6 +93,22 @@ public:
 
 	QSslCertificate qscCert;
 	QSslKey qskKey;
+
+	/// qlIntermediates contains the certificates
+	/// from PEM bundle pointed to by murmur.ini's
+	/// sslCert option that do not match the key
+	/// pointed to by murmur.ini's sslKey option.
+	///
+	/// Simply put: it contains any certificates
+	/// that aren't the main certificate, or "leaf"
+	/// certificate.
+	QList<QSslCertificate> qlIntermediates;
+
+	/// qlCA contains all certificates read from
+	/// the PEM bundle pointed to by murmur.ini's
+	/// sslCA option.
+	QList<QSslCertificate> qlCA;
+
 	QByteArray qbaDHParams;
 	QByteArray qbaPassPhrase;
 	QString qsCiphers;